Prevention of rendezvous generation algorithm (RGA) and domain generation algorithm (DGA) malware over existing internet services

Abstract

A method, computer program product, system and apparatus for the prevention of RGA and DGA malware over an existing internet service is disclosed. The invention exploits the fact that when malware rapidly attempts to access many contact points, a malware is likely to need several attempts to find a current server. Software is installed on the individual endpoints in a network of internet services. The software monitors the websites or services and collects information about access attempts. The invention detects a series of failed attempts by the malware to access the service / website. These attempts can be accrued by being temporally linked (e.g., many attempts in a short time, many attempts consecutively), conceptually linked (e.g., similar addresses, similar attempts across multiple machines or time scales), higher than normal prevalence or other methods. The invention provides an indication of a malware attempt if enough failed attempts have accrued.

Description

[0001]This application claims the benefit of U.S. Provisional Application No. 62 / 273,768, filed Dec. 31, 2015, the entire disclosure of which is herein incorporated by reference.TECHNICAL FIELD OF THE INVENTION[0002]The present invention relates to computer security, and more specifically to prevention of malware attacks.BACKGROUND OF THE INVENTION[0003]There are many types of malware which communicate back to their controller. These communications can consist of receiving commands and updates, exfiltrating data and passing other information in either direction. However, the use of single (or a small number of) pre-defined or hardcoded web-based points of communication (i.e. “rendezvous locations”) such as a single domain, email address, twitter account, etc. to which the malware can connect, leaves the malware vulnerable to being disrupted by the loss of control of that rendezvous location. Such loss can occur most frequently when law enforcement or cyber-security organizations tak...

AI Technical Summary

Benefits of technology

[0023]The present invention offers a solution on the defense side, which is to detect when an attempt was made to access a contact point which does not exist. In addition, the operator of the malware must have redundancy in the usage of DGA. Some possible command and control (C&C) will not be used or will be used for very short time periods. Thus, when malware rapidly attempts to access many contact points such as multiple C&C channels, a malware is likely to need several attempts to find a current C&C channel.

Problems solved by technology

In addition, the operator of the malware must have redundancy in the usage of DGA.

Thus, when malware rapidly attempts to access many contact points such as multiple C&C channels, a malware is likely to need several attempts to find a current C&C channel.

Network-based solutions will often fail for encrypted communication, for example websites which use the HTTPS protocol, and therefore only an endpoint-based solution will be able to detect these indications of non-existence.

However, in many cases the algorithm will not have such specific knowledge.

Such a mistake will be what happens when a DGA attempts to access something which does not exist.

Images